Kafka feature support
This matrix describes Dekaf's client-facing scope. It is not a checklist of every Java client, Kafka Streams, Connect, or broker-only KIP. A wire codec alone does not establish a working client feature. Read API and Runtime Compatibility for package assets and configured broker coverage.
Last reviewed: 2026-09-14. Broker API versions and finalized feature levels
are the capability requirements; an accepted KIP or a version advertised in
ApiVersions does not prove that every broker behavior is implemented.
Status and evidence
- Complete: the client behavior named in the row is implemented. This does not claim every part of the linked KIP or every Java API is supported.
- Partial: usable support exists, with a specific remaining limitation.
- Excluded / deferred: intentionally outside the current client scope.
- Experimental: code exists, but supporting broker behavior or complete real-broker acceptance is not established.
Evidence is labeled separately: Source means implementation/tests were inspected; Configured CI means the linked tests are selected by maintained workflows, subject to their capability/platform skips. Neither label claims a successful execution. Run requires a direct successful run/artifact link, commit SHA, runtime, broker image, and relevant test outcomes. This page makes no Run claim; consult linked issues and PRs for historical results.
Unless a row says otherwise, runtime coverage follows the core's net10.0 and
net8.0 assets, with configured .NET 10 and .NET 8 tests respectively.
The separate netstandard2.0 asset retains its documented compatibility limits.
No additional OS restriction is known for those managed protocol paths; CI
coverage is Linux, not a certification of every OS. Historical protocol minima
below do not extend Dekaf's tested broker range to older Kafka releases.
Consumer coordination and fetching
| Feature / authoritative KIP | Status and scope | Broker requirement | Implementation / documentation | Evidence and remaining work |
|---|---|---|---|---|
| KIP-848 consumer groups | Complete: server-side assignment, membership, reconciliation and heartbeats | Kafka 4.0+; ConsumerGroupHeartbeat v0+, enabled consumer protocol | Consumer groups, coordinator | Configured CI: coordination unit tests, group integration tests. Client-side assignors are outside this row. |
| Classic group participation (pre-KIP-848) | Excluded: no JoinGroup/SyncGroup consumer mode | Not applicable; use modern consumer groups on Kafka 4.0+ | Protocol decision | Source: coordinator tests; intentional decision #2747. Admin inspection of classic groups does not imply participation. |
| KIP-227 incremental fetch sessions | Complete: session establishment, incremental updates and recovery | Fetch v7+ | Fetch session handler, consumer options | Configured CI: session tests. No outstanding issue tracked for this scope. |
| KIP-320 log truncation handling | Complete: consumer epoch tracking and fetch-position recovery | Epoch fields require Fetch v9+; last-fetched epoch uses v12+ | Consumer implementation, offset management | Configured CI: truncation integration tests. No claim of replica/broker implementation. |
| KIP-951 leader discovery | Complete: use leader hints in produce/fetch responses and recover through metadata | Produce v10+ / Fetch v16+ for hints; older versions use metadata recovery | Response fields | Configured CI: wire tests, consumer failover, producer failover. No outstanding issue tracked. |
Producers and share consumers
| Feature / authoritative KIP | Status and scope | Broker requirement | Implementation / documentation | Evidence and remaining work |
|---|---|---|---|---|
| KIP-98 idempotence and transactions | Complete: sequenced production, commit/abort, transactional offsets and read-committed consumption | Transaction APIs and record batch format v2 (Kafka 0.11+ protocol); group-based consumption additionally requires Kafka 4.0+ | Transactions, producer | Configured CI: idempotence, transactions, isolation. Exactly-once external side effects require application coordination. |
| KIP-890 Transactions V2 | Complete: negotiate V2 and adopt producer identity returned at transaction completion | transaction.version 2+, InitProducerId / EndTxn v5+; Kafka 4.0+ | Producer | Configured CI: V2 integration tests. No outstanding issue tracked for this scope. |
| KIP-939 external two-phase commit | Experimental: prepare and complete prepared transactions | transaction.version 3+ and InitProducerId v6; require an explicitly supporting broker, not merely Kafka 4.x | Two-phase transaction API, options | Source: transaction unit tests, wire tests. No successful supporting-broker run cited; KIP acceptance is not release evidence. |
| KIP-932 share consumption | Complete for queue consumption: explicit acknowledgements, record ownership, renewal and close | Dekaf requires ShareGroupHeartbeat v1 and ShareAcknowledge v1+; ShareFetch v0+; share groups enabled. Integration tests require Kafka 4.2+. Upstream: 4.0 early access, 4.1 preview, 4.2 completed | Share consumers, implementation | Configured CI: share integration tests, ownership tests. Early-access broker support is not a production recommendation. |
Telemetry and authentication
| Feature / authoritative KIP | Status and scope | Broker / runtime requirement | Implementation / documentation | Evidence and remaining work |
|---|---|---|---|---|
| KIP-714 telemetry transport and required metrics | Complete for subscription, identity, push and required producer/consumer metrics | GetTelemetrySubscriptions and PushTelemetry v0; broker subscription and receiver configured | Observability, telemetry manager | Configured CI: manager tests, receiver integration tests (Kafka 4.2+ fixture gate). This is narrower than complete KIP-714 support. |
| KIP-714 standard metric catalog | Complete for applicable producer and ordinary-consumer metrics, including connection rates, queue times, commit/fetch/rebalance timing, assignments and asynchronous poll idle ratio | Same telemetry APIs; subscription selects requested metrics; measurement boundaries and reset behavior are documented | Metric collector, standard metrics, observability | Configured CI: standard metric tests, collector tests, receiver integration tests. Delivered under #3311. |
| KIP-714 OTLP resource labels | Complete: configured rack/group/static membership/transaction IDs and current joined member ID; unavailable values omitted | Same telemetry APIs and OTLP payload format; attributes apply only to the relevant client roles | Resource attributes, payload provider | Configured CI: resource decoding tests, receiver integration tests. Delivered under #3312. |
| KIP-43 PLAIN and KIP-84 SCRAM | Complete: PLAIN, SCRAM-SHA-256 and SCRAM-SHA-512 | Broker listener must enable selected mechanism; SaslHandshake v1 and SaslAuthenticate v2+. Both core runtime paths | SASL configuration | Configured CI: authentication tests, SASL/TLS tests. No outstanding issue tracked. |
| KIP-255 OAUTHBEARER | Complete for token authentication and refresh | OAUTHBEARER-enabled broker and token provider; SaslHandshake v1 / SaslAuthenticate v2+; both core runtime paths | OAuth, authenticator | Source: authenticator tests, refresh concurrency tests. Provider-specific deployments need their own validation. |
| KIP-368 SASL re-authentication | Complete: negotiated session lifetime and gated connection exchange | Session lifetime introduced in SaslAuthenticate v1; Dekaf negotiates v2+ and requires broker session lifetime; supported underlying mechanism required | Connection implementation | Configured CI: re-authentication integration tests. GSSAPI runtime restrictions still apply. |
| KIP-12 GSSAPI / Kerberos | Complete for .NET 8 and .NET 10 package consumers; the netstandard2.0 asset remains unsupported | GSSAPI-enabled listener with SaslHandshake v1 / SaslAuthenticate v2+; .NET 8 and .NET 10 use Windows SSPI or Unix GSSAPI. Linux requires Kerberos libraries/credentials; macOS uses Heimdal. Windows explicit KeytabPath is unsupported; use credential store/service identity | SASL, authenticator, configuration | Configured CI: local KDC round trip runs on Linux/.NET 8 and .NET 10, including clean NuGet consumers and invalid service rejection. Windows/macOS support here is Source evidence. Package asset coverage: #3313. |
Administration and Streams scope
Admin capabilities negotiate versions per destination. Optional interfaces expose
additional operations without requiring every custom IAdminClient to implement
them. The following rows identify representative capability boundaries; consult
IAdminClient and the administration navigation for
the full maintained API surface.
| Feature / authoritative KIP | Status and scope | Broker requirement | Implementation / documentation | Evidence and remaining work |
|---|---|---|---|---|
| KIP-516 topic IDs in Admin operations | Complete: describe and delete by ID | Metadata v10+ for description; DeleteTopics v6 for deletion | Topic identifiers | Configured CI: Admin topic-ID tests. No outstanding issue tracked. |
| KIP-1043 group administration | Complete: group-type listing and classic group description | ListGroups v4 for state filters, v5 for type filters; classic description uses DescribeGroups | Group listing | Configured CI: listing tests, classic description tests. Does not add classic consumer participation. |
| KIP-584 feature administration | Complete: inspect finalized features and request feature updates | ApiVersions v3+ feature fields and UpdateFeatures v0+; requested level must be supported by destination | Node features, Admin API | Configured CI: feature tests. Broker upgrade policy remains an operator responsibility. |
| KIP-1071 Streams membership | Partial / experimental for complete lifecycle: join, assignments, leave/rejoin and fencing implemented; later lifecycle fields await broker acceptance | StreamsGroupHeartbeat v0; Dekaf requires Kafka 4.2+. Task offsets/static membership tests target Kafka 4.4 because 4.3.1 rejects them | Membership interface, Streams administration | Configured CI: membership tests, with explicit 4.4 capability skips. Source: unit tests. Complete lifecycle: #2958, parent #2766. |
| Streams processing runtime (distinct from KIP-1071) | Deferred: no topology DSL, state stores, changelog restoration or processing runtime | Not applicable until runtime scope is reopened | Membership scope | Source: in-memory membership tests cover membership only, not a runtime. Existing decision tracker #2748. |
Released brokers and future protocol work
Use the configured compatibility coverage and CI workflow for released Kafka 4.x testing. The official Apache download index has no Kafka 4.4 release at this review date. Kafka 4.4 lifecycle checks remain future acceptance under #2958; do not treat their source or capability skips as a passing 4.4 run. Likewise, the KIP-939 row records a feature level requirement, not a claim that every released 4.x broker supports it.
Maintaining this matrix
When a change adds, removes or limits support, update its row in the same PR. Check the authoritative KIP and the destination API/feature gate; update runtime limits, maintained documentation, tests and outstanding issue links together. Keep completed decisions linked when they explain an exclusion. Split a row when one part ships and another remains experimental. Link CI, performance gate and stress tests instead of copying their matrices here. Promote evidence to Run only with the exact run URL, SHA, runtime, broker image and relevant results; skipped cases remain unverified.